一次被刪庫的事故記錄

今天早上打算完善一下任務調度管理器的 README.md 文檔時，發現管理後臺登陸不上去，覺得是 JWT 令牌過時，可是嘗試從新登陸幾回，仍是登不上。登陸服務器一看，幾個數據表所有不見了！


我都蒙了，數據怎麼忽然就沒了呢。MongoDB 的服務仍是正常運行的，沒看到有崩潰，真是奇了個怪的。不過在 show dbs; 時，發現多了一個 db ： 

HOW_TO_RECOVERY_BASE  0.000GB

跟進去那個 db ，發現有一個名叫 README 的集合， db.README.find() 看到有一條記錄：

{
       "_id" : ObjectId("5e94c8b2d2be92596522c194"),
       "content" : "All your data is a backed up. You must pay 0.015 BTC to 1jAzyxPREckuUPwifEbiUKgDfE5racmph 48 hours for recover it. After 48 hours expiration we will leaked and exposed all your data. Also do not forget about GDPR. You can buy bitcoin here, does not take much time to buy https://localbitcoins.com with this guide https://localbitcoins.com/guides/how-to-buy-bitcoins After paying write to me in the mail with your DB IP : g3t_base@protonmail.com"
}

我 xxx ！被清空數據勒索了！！

檢查了MongoDB 服務日記，發現了一個外網的客戶端鏈接，由於我本身的程序都是用環回地址鏈接數據庫的，因此這個外網的鏈接很明顯是搞事情的。

2020-04-13T16:50:26.350+0800 I  NETWORK  [listener] connection accepted from 45.227.255.190:42350 #6921 (13 connections now open)
2020-04-13T16:50:26.351+0800 I  NETWORK  [conn6921] received client metadata from 45.227.255.190:42350 conn6921: { driver: { name: "PyMongo", version: "3.10.1" }, os: { type: "Linux", name: "Linux", architecture: "x86_64", version: "4.15.18-9-pve" }, platform: "CPython 3.5.3.final.0" }
2020-04-13T16:50:26.779+0800 I  NETWORK  [listener] connection accepted from 45.227.255.190:42404 #6922 (14 connections now open)
2020-04-13T16:50:26.780+0800 I  NETWORK  [conn6922] received client metadata from 45.227.255.190:42404 conn6922: { driver: { name: "PyMongo", version: "3.10.1" }, os: { type: "Linux", name: "Linux", architecture: "x86_64", version: "4.15.18-9-pve" }, platform: "CPython 3.5.3.final.0" }
2020-04-13T16:50:29.529+0800 I  NETWORK  [conn6922] end connection 45.227.255.190:42404 (13 connections now open)
2020-04-13T16:50:30.192+0800 I  NETWORK  [conn6921] end connection 45.227.255.190:42350 (12 connections now open)
2020-04-14T04:16:48.437+0800 I  NETWORK  [listener] connection accepted from 45.227.255.190:57032 #7172 (12 connections now open)
2020-04-14T04:16:48.438+0800 I  NETWORK  [conn7172] received client metadata from 45.227.255.190:57032 conn7172: { driver: { name: "PyMongo", version: "3.10.1" }, os: { type: "Linux", name: "Linux", architecture: "x86_64", version: "4.15.18-9-pve" }, platform: "CPython 3.5.3.final.0" }
2020-04-14T04:16:48.879+0800 I  NETWORK  [listener] connection accepted from 45.227.255.190:57118 #7173 (13 connections now open)
2020-04-14T04:16:48.879+0800 I  NETWORK  [conn7173] received client metadata from 45.227.255.190:57118 conn7173: { driver: { name: "PyMongo", version: "3.10.1" }, os: { type: "Linux", name: "Linux", architecture: "x86_64", version: "4.15.18-9-pve" }, platform: "CPython 3.5.3.final.0" }
2020-04-14T04:16:50.485+0800 I  NETWORK  [conn7172] end connection 45.227.255.190:57032 (12 connections now open)
2020-04-14T04:16:50.490+0800 I  NETWORK  [conn7173] end connection 45.227.255.190:57118 (11 connections now open)

查了下 IP 的信息

IP地址: 45.227.255.190荷蘭阿姆斯特丹

從日誌能夠看出，在 13 號下午和 14 四號凌晨，有個使用 CPython 作的程序兩次鏈接到了MongoDB服務，在第二次的時候把個人整個數據庫的數據都清了，而後留下一個指引我上交比特幣恢復數據的信息。


跟到這裏已經很明顯了，有人利用端口掃描之類的工具，找到了個人沒有限制 IP、使用默認端口、沒有密碼的MongoDB 服務，而後刪把數據刪了，留個比特幣帳號和郵箱，讓我給他比特幣再給我回複數據。

萬幸的是，被清空的只是測試數據。被刪掉的是定時任務管理器上線一週多的測試任務數據，對我來講不是很重要,沒有花錢恢復的必要。

這個事故提醒了我，數據安全不可忽視！

在此，個人 MongoDB 服務器能夠作的至少有如下幾件事：

• 只容許內網訪問
• 更改服務默認端口
• 設置數據庫密碼
• 定時備份數據

最後，我有點想感謝那個刪我數據庫的傢伙，是他用實際行動提醒了我，別再大意了，注意數據安全！

嗯，比特幣是沒有了，仍是給他回一封郵件吧。